Hi ,
I am in a situation , we have 3 search heads clustered using a 3rd party SSL certs placed in web.conf after the splunk web ui is not accessed.
i received 2 certs from a 3rd party company one is , .pem and one is .key certs, i placed those 2 certs under /opt/splunk/etc/auth/xyz folder and then i go to /opt/splunk/etc/system/local folder edited the web.conf and updated it as splunk mentioned
[settings]
enableSplunkWebSSL = true
privKeyPath = /opt/splunk/etc/auth/mycerts/mySplunkWebPrivateKey.key
serverCert = /opt/splunk/etc/auth/mycerts/mySplunkWebCertificate.pem
then i restart the splunk but the UI didnt comes up.
What mistakes i did ? Please if anyone can help will be great ?
Problem resolved , I updated my .key file which was password protected and splunk was unable to read the key file , after removing the password from key file splunk is able to read it and problem resolved.
Problem resolved , I updated my .key file which was password protected and splunk was unable to read the key file , after removing the password from key file splunk is able to read it and problem resolved.
Hi,
Any error in $SPLUNK_HOME/var/log/splunk/splunkd.log
OR web_access.log
OR web_service.log
? As you are using search head in clustered, how are you accessing Search Head Web (Through any Load Balancer ? If yes then have you tried to access Search Head Web directly like https://SEARCH_HEAD_SERVER:8000 ?)
Thanks harsa ,
Problem resolved , I updated my .key file which was password protected and splunk was unable to read the key file , after removing the password from key file splunk is able to read it and problem resolved.